Last Updated: Oct 22, 2025
Overview
When an RKE2 agent fails to authenticate with the server, the worker node(s) can enter a NotReady state. The agent service may get stuck in the “activating” state while waiting to retrieve its configuration, showing an error like:
msg="Waiting to retrieve agent configuration; server is not ready:
/var/lib/rancher/rke2/agent/serving-kubelet.crt: Node password rejected, duplicate
hostname or contents of '/etc/rancher/node/password' may not match server node-passwd
entry, try enabling a unique node name with the --with-node-id flag"This error usually indicates one or more of the following issues:
The node password is rejected by the server.
The node hostname is duplicated within the cluster.
The local node password file does not match the server’s stored credentials.
Prerequisites
- RKE2 managed Kubernetes cluster
- Access to the RKE2 cluster/kubeconfig file
Step-by-Step Instructions
To resolve this issue, you need to clear the stale node password secret on the server that is blocking the agent’s registration, then restart the agent service on the affected node(s).
1. Stop the RKE2 agent service on the node being registered
$ sudo systemctl stop rke2-agent.service2. Find the node-password secret that was not cleaned up by running the following command with a kubeconfig file pointed to the RKE2 cluster
$ kubectl get secret -n kube-system | grep node-password.rke2This will list secrets named in the format: <NODE_NAME>.node-password.rke2
For example, the secret for the affected node might be: ip-10-0-0-31.node-password.rke2
3. Delete the secret corresponding to the node in question
$ kubectl delete secret -n kube-system ip-10-0-0-31.node-password.rke24. Start the RKE2 agent service again on the node
$ sudo systemctl start rke2-agent.service